1387853 - genHPKPStaticPins.js fails with "ERROR: Can't find 'AddTrust Public Services Root' in certNameToSKD"

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P1)

Description

[Tim Taubert [:ttaubert] (inactive)]

I tried to run genHPKPStaticPins.js locally and it fails with the following error:

./obj-x86_64-apple-darwin16.7.0/dist/bin/run-mozilla.sh obj-x86_64-apple-darwin16.7.0/dist/bin/xpcshell security/manager/tools/genHPKPStaticPins.js security/manager/tools/PreloadedHPKPins.json foobar security/manager/ssl/StaticHPKPins.h

Can't find hash in builtin certs for Chrome nickname GoogleG2, inserting GOOGLE_PIN_GoogleG2
Can't find hash in builtin certs for Chrome nickname RapidSSL, inserting GOOGLE_PIN_RapidSSL
Can't find hash in builtin certs for Chrome nickname VeriSignClass1, inserting GOOGLE_PIN_VeriSignClass1
Can't find hash in builtin certs for Chrome nickname VeriSignClass4_G3, inserting GOOGLE_PIN_VeriSignClass4_G3
Can't find hash in builtin certs for Chrome nickname VeriSignClass3_G2, inserting GOOGLE_PIN_VeriSignClass3_G2
Can't find hash in builtin certs for Chrome nickname VeriSignClass2_G2, inserting GOOGLE_PIN_VeriSignClass2_G2
Can't find hash in builtin certs for Chrome nickname GeoTrustGlobal2, inserting GOOGLE_PIN_GeoTrustGlobal2
Can't find hash in builtin certs for Chrome nickname Entrust_SSL, inserting GOOGLE_PIN_Entrust_SSL
Can't find hash in builtin certs for Chrome nickname AddTrustPublicCARoot, inserting GOOGLE_PIN_AddTrustPublicCARoot
Can't find hash in builtin certs for Chrome nickname AddTrustQualifiedCARoot, inserting GOOGLE_PIN_AddTrustQualifiedCARoot
Can't find hash in builtin certs for Chrome nickname SecureCertificateServices, inserting GOOGLE_PIN_SecureCertificateServices
Can't find hash in builtin certs for Chrome nickname TrustedCertificateServices, inserting GOOGLE_PIN_TrustedCertificateServices
Can't find hash in builtin certs for Chrome nickname UTNDATACorpSGC, inserting GOOGLE_PIN_UTNDATACorpSGC
Can't find hash in builtin certs for Chrome nickname UTNUSERFirstHardware, inserting GOOGLE_PIN_UTNUSERFirstHardware
Can't find hash in builtin certs for Chrome nickname UTNUSERFirstObject, inserting GOOGLE_PIN_UTNUSERFirstObject
Can't find hash in builtin certs for Chrome nickname GTECyberTrustGlobalRoot, inserting GOOGLE_PIN_GTECyberTrustGlobalRoot
Can't find hash in builtin certs for Chrome nickname GoDaddySecure, inserting GOOGLE_PIN_GoDaddySecure
Can't find hash in builtin certs for Chrome nickname SymantecClass3EVG3, inserting GOOGLE_PIN_SymantecClass3EVG3
Can't find hash in builtin certs for Chrome nickname DigiCertECCSecureServerCA, inserting GOOGLE_PIN_DigiCertECCSecureServerCA
Can't find hash in builtin certs for Chrome nickname COMODORSADomainValidationSecureServerCA, inserting GOOGLE_PIN_COMODORSADomainValidationSecureServerCA
JavaScript error: ./security/manager/tools/genHPKPStaticPins.js, line 452: Error: ERROR: Can't find 'AddTrust Public Services Root' in certNameToSKD

Do we catch/log these errors somehow?

Comment 1

[:Cykesiopka]

This is the result of some root removals done in Bug 1380941.
This change landed in Firefox's copy of NSS in Bug 1370890.

(In reply to Tim Taubert [:ttaubert] from comment #0)
> Do we catch/log these errors somehow?

Yes, but in an obscure location:
1. Go to https://archive.mozilla.org/pub/firefox/tinderbox-builds/mozilla-central-linux64/
2. Find the "mozilla-central-linux64-periodicupdate-*" for the correct date.

Maybe there's a nicer way now, but I'm not aware of it.
There are various bugs like Bug 1303848 filed to make this nicer.

Comment 2

[:Cykesiopka]

Attachment: Bug 1387853 - Update Google roots in PreloadedHPKPins.json to fix periodic Static HPKP updates.

The relevant roots were removed in upstream NSS in Bug 1380941.
The equivalent change landed in Firefox's copy of NSS in Bug 1370890.

Review commit: https://reviewboard.mozilla.org/r/165706/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/165706/

Comment 3

[Dana Keeler (she/her) [:keeler]]

Comment on attachment 8894552 [details]
Bug 1387853 - Update Google roots in PreloadedHPKPins.json to fix periodic Static HPKP updates.

https://reviewboard.mozilla.org/r/165706/#review170804

D'oh - forgot to do this. Thanks for picking it up.
Is this output from security/manager/tools/dumpGoogleRoots.js? I'm getting slightly different results (probably as a result of the change to using .displayName...)
In any case, this looks correct, but I think we should stick to using the script rather than editing this by hand.

Comment 5

[:Cykesiopka]

Comment on attachment 8894552 [details]
Bug 1387853 - Update Google roots in PreloadedHPKPins.json to fix periodic Static HPKP updates.

https://reviewboard.mozilla.org/r/165706/#review170804

No worries. I think I'll look into refactoring the two periodic scripts so we can add tests and catch these things earlier.

> Is this output from security/manager/tools/dumpGoogleRoots.js?
No. To be honest I forgot that script even existed. I'll update the patch using the script.

Comment 6

[:Cykesiopka]

Comment on attachment 8894552 [details]
Bug 1387853 - Update Google roots in PreloadedHPKPins.json to fix periodic Static HPKP updates.

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/165706/diff/1-2/

Comment 7

[Dana Keeler (she/her) [:keeler]]

Comment on attachment 8894552 [details]
Bug 1387853 - Update Google roots in PreloadedHPKPins.json to fix periodic Static HPKP updates.

https://reviewboard.mozilla.org/r/165706/#review171304

Great - thanks!

Comment 8

[:Cykesiopka]

Thanks for the review.
(This change is NPOTB.)

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d5e794c72672
Update Google roots in PreloadedHPKPins.json to fix periodic Static HPKP updates. r=keeler

Comment 10

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/d5e794c72672